Extensive Core Services API Documentation

[Anonymous]

As part of NetWitness platform 11.7, a comprehensive standalone document outlines all the supported application programming interfaces (APIs) available.

This separate document will help users or potential users of the NetWitness core services (archiver, appliance, broker, concentrator, decoder, log decoder) understand the available integration points and automation options. Includes everything from port required opened, the API schema, supported Authentication & Authorization, all the API calls available for each service, manuals, and examples.

Prior to this document being available the operational details of the API were only accessible as a part of the functional service limiting who could review all the capabilities.

The new document is available for download Core Services API Guide 

[ChrisIchelson]

William,

Any ideas if endpoint risk scoring and file risk scoring can be reset over the API yet?  Similar to stop scan vs start scan in 11.7?

[PavankumarMudal]

We do have nw-shell API's to reset risk scores.

Connect to respond-server and use the following API to reset Host and file risk score.

connect --service respond-server

to reset File risk score: 

cd respond/risk/context/file/reset
invoke '["<SHA256>"]'

to reset Host risk score:

cd respond/risk/context/host/reset
invoke '["<AgentID>"]'

[Anonymous]

Can these nw-shell APIs be accessed remotely from another host?

[Anonymous]

@Anonymous  - any word on when this extensive API documentation will be released?

@PavankumarMudal - can resetting the host risk score be done via the API from a remote host like a SOAR tool like Demisto?

[Anonymous]

@Anonymous Yes, the updated core services API documentation was released with Netwitness 11.7 - in case the link in the above blog was not clear, here is the direct link - https://community.rsa.com/t5/netwitness-platform-online/core-services-api-guide-for-11-7/ta-p/655327

[PavankumarMudal]

@Anonymous , Reset of Risk score and host tag management via REST api is prioritized and should make it in near future.